Discovery in Civil Matters

Discovery of Medical, Mental Health and Substance Abuse Treatment Records
(Has HIPAA really changed anything?)
By D. Renée Hildebrant and Jami Fenner

It is time for trial attorneys to turn their attention to the effect HIPAA, the Health Insurance Privacy and Accountability Act ("HIPAA") of 1996, will have on discovery of health care information. Pursuant to the "administrative simplification" provisions of that Act, the U.S. Department of Health and Human Services issued the final Standards for Privacy of Individually Identifiable Health Information (commonly referred to as HIPAA Privacy Rules) in August 2002.1 These rules went into effect on April 14, 2003 and protect the privacy of health care information. Attorneys for health care providers have been busy working with their clients to comply with these privacy regulations for some time.

While HIPAA is the first federal law protecting all health care information, it is not the first federal privacy provision of its kind. What many attorneys do not realize is that since the early 1970's federal law has protected the confidentiality of alcohol and drug abuse treatment records.2 Therefore, if a trial attorney is following current state and federal law correctly, she will notice little difference in the discovery of mental health and substance abuse treatment records but should notice health care providers, and others holding health care related information such as insurers and health plans, requiring additional information before releasing ordinary medical records.

While both medical records and mental health and substance abuse treatment records are confidential and privileged3, it is much easier to obtain medical records than mental health and substance abuse treatment records. Prior to HIPAA, medical records generally could be obtained simply by issuing a subpoena because a person was considered to have waived any privilege that may have attached to those records.4 However, because federal law preempts state law, (recall the war that was fought over this issue), substance abuse records cannot be obtained merely by issuing a subpoena for their release.5 Because mental health treatment records often contain a diagnosis or referral to treatment for drug or alcohol abuse, the same federal law that protects substance abuse treatment records likely protects those mental health records and preempts any state law implied waivers to release of such information. For this reason, as is discussed herein, it is recommended that attorneys wishing to obtain mental health records proceed as if they are protected by 42 C.F.R. Part 2 which protects the confidentiality of alcohol and drug abuse treatment records and follow the same requirements for obtaining copies of those records.

MEDICAL RECORDS

I. Use of Consent to Obtain Medical Records
Discovery of medical records and information still requires written consent by the patient or the use of a subpoena or court order. However, the form that must now be used is different in light of HIPAA. (HIPAA uses the term authorization; many lawyers use the term release; consent is used here.) HIPAA uses the words "consent" and "authorization" as terms of art, both with a different meaning. A consent under HIPAA is document which will authorize the use of health care information for "treatment, payment or health care operations."6 An authorization under HIPAA is a document signed by the patient that will allow the disclosure of health care information for the purpose stated on the release.7 Under 42 C.F.R. Part 2, the word "consent" is used in the same manner as HIPAA uses the term "authorization."8 Oklahoma law regarding mental health and substance abuse treatment records uses the terms "release" and "consent" interchangeably.9 Whatever title an attorney decides to place on the document authorizing disclosure of records, the elements of state and federal law must be contained in the document and are spelled out below.

State law requirements regarding release of health care information continue to apply, where not preempted by HIPAA, and must also be followed. Attorneys who fail to use a valid consent form containing all the required elements likely will have the form returned to them without any records.

A consent for release of ordinary medical records which complies with Oklahoma law and HIPAA must contain:

Most health care providers track records by either date of birth or social security number; thus, it is helpful to have that information on the release as well. A form for release of medical information which complies with both HIPAA and state law can be found on the Internet at 1) http://my.okbar.org/ or 2) www.oba-net.org, File Library, Litigation & Appeals.

Because of the way in which the HIPAA required elements, g, h and i, are written and the broadness of HIPAA and state law, a particular health care provider, or its attorney, may have drafted its approved consent form differently. Thus, although the elements listed above and demonstrated on the consent comply with HIPAA and state law, a health care provider may refuse to honor it and instead require you to use its consent form. Hopefully, attorneys and health care providers will work together as they have in the past to ensure the confidentiality of patients' records while at the same time allowing for the necessary discovery of the records. Records from large health care organizations will likely be much more difficult to obtain than records from doctors in private practice.

II. Use of a Court Order or Subpoena to Obtain Medical Records
An attorney needing medical records as part of the discovery process should always try to obtain them with consent from the person whose records are needed. In the event the attorney cannot obtain consent from the patient, HIPAA continues to allow health care providers to release information with a court order or a subpoena so long as certain conditions are met.11 A health care provider is required to release only those records expressly authorized by the court order.12 If it is necessary to obtain a court order, attorneys need to make the order for release of information as specific and comprehensive as possible to ensure the receipt of all desired information.

An attorney may choose to issue a subpoena without an accompanying court order, but the health care provider will not release information unless certain assurances are made by the attorney. The attorney seeking the information must provide the health care provider with a written statement and supporting documentation showing the individual whose records are sought has been given notice of the request, been provided an opportunity to object and that he either did not object or the court ordered the release as requested by the attorney.13 In the alternative, the requesting attorney may provide a copy of an agreed qualified protective order or assure the health care provider that a qualified protective order has been sought from the court or tribunal.14 The phrase "qualified protective order" is a term of art under HIPAA. It must prohibit the parties from using the health information for any purpose other than the current litigation and require the return or destruction of the records, including all copies made, at the end of the litigation.15 This requirement means attorneys will need to start purging their files of all medical records before closing the file.

If a subpoena is issued to a health care provider without the above assurances by the requesting attorney, the provider can only produce the records if the provider notifies the patient of the request and gives the patient an opportunity to object or if the provider seeks a qualified protective order. However, attorneys should not simply issue a subpoena and then sit back and wait for the health care provider to obtain the consent or seek the qualified protective order. The preamble to the Final HIPAA Rule makes clear that the Department of Health and Human Services does not intend to require providers to provide notice to the consumer or to seek protective orders.16 In other words, attorneys are responsible for providing the health care provider with the documentation necessary to allow for the release of records.

III. Use of a Business Associate Agreement to Obtain Medical Records
While not technically considered discovery, an attorney representing a health care provider obviously must have access to patient records. Nonetheless, an attorney representing a health care provider cannot review the records of that provider that pertain to patients, including a patient who is the subject of litigation on which the attorney is working, unless the attorney enters into a Business Associate Agreement with the provider, or obtains consent from the patient whose records are at issue.17 Under a Business Associate Agreement, the attorney agrees to essentially follow the HIPAA Privacy Rules.18 There are many required provisions in the Business Associate Agreement that may concern attorneys, such as the requirement to destroy or return all health care records and requirements regarding accountings of disclosures of health care information and amendments to records.19 These requirements and the implementation of the requirements are beyond the scope of this article. However, a sample Business Associate Agreement can be found on the Internet at 1) http://my.okbar.org/ or 2) www.oba-net.org, File Library, Litigation & Appeals.   There are many different versions of business associate agreements on the internet and proposed by different health care professionals in Oklahoma. The sample Business Associate Agreement contains only the basic required elements; attorneys may discover their clients have their own business associate agreement form they require.

MENTAL HEALTH AND SUBSTANCE ABUSE TREATMENT RECORDS

Mental health and substance abuse treatment records have always enjoyed a higher level of protection than medical records. The reason for the extra protections is because we as a society want persons with mental illness or alcohol or drug abuse problems to get treatment, but there is often a stigma attached to those who do have mental health or substance abuse problems and they often avoid seeking treatment because of this stigma. By providing an extra level of protection for mental health and substance abuse treatment records, it is believed people will be more likely to seek treatment for these conditions and be more likely to engage in full disclosure, which will assist with the person's recovery. The extra protections for mental health and substance abuse treatment records is based primarily on Oklahoma Mental Health Law, 43A O.S. § 1-109, federal law, 42 C.F.R. Part 2 and now to a certain extent HIPAA. HIPAA provides extra protection to psychotherapy notes.20

The general HIPAA conditions discussed above apply to mental health and substance abuse treatment records, except to the extent other state or federal laws provide more protection to the release of protected health care information.21 Thus, the stricter requirements of 42 C.F.R. Part 2 must be followed when seeking substance abuse treatment records from a "program" that receives federal funding from any source, whether it is through a grant or because the health care provider is a non-profit organization.22 "Program" is a term of art used in 42 C.F.R. Part 2 to refer to persons or organizations that receive "federal assistance,"23 in whole or in part, and provide alcohol or drug abuse diagnosis, treatment, referral for treatment or prevention.24

Because most mental health facilities provide treatment for alcohol or drug abuse problems, or at least diagnosis or referral of individuals with those problems, they are covered by 42 C.F.R. Part 2 assuming they are also federally funded or non-profit corporations. For example, all facilities operated by the Oklahoma Department of Mental Health and Substance Abuse Services (ODMHSAS) are covered by HIPAA, 42 C.F.R. Part 2 and state confidentiality laws. Additionally, the non-profit mental health treatment entities with which ODMHSAS contracts are also considered programs under 42 C.F.R. Part 2. Because it may be difficult to determine if a mental health facility is non-profit or is federally funded, it is best to use a consent form that complies with HIPAA, 42 C.F.R. Part 2 and Oklahoma law to obtain records from mental health or substance abuse treatment facilities.

I. Use of Consent to Obtain Mental Health and Substance Abuse Treatment Records
The elements of a consent form for mental health or substance abuse treatment records are not that different from the elements of a consent form for ordinary medical records thanks to HIPAA. A consent for release of information form that complies with HIPAA, 42 C.F.R. Part 2 and state law will contain the following:

A consent form which complies with all state and federal laws regarding the release of mental health and substance abuse treatment records can be found on the Internet at 1) http://my.okbar.org/ or 2) www.oba-net.org, File Library, Litigation & Appeals. In addition to the consent for release, if the records are sought by an attorney other than the attorney for the patient, the consent should be accompanied by a subpoena duces tecum.26 This is because a consent only authorizes but does not compel release.27

HIPAA does not allow a consent to obtain psychotherapy notes to be combined with any other type of consent.28 Thus, an attorney should get two consents for release of mental health records, one that requests copies of any type of mental health record other than psychotherapy notes and one that requests only psychotherapy notes. However, an attorney should not expect all mental health facilities or all psychotherapists to have psychotherapy notes. According to HIPAA, psychotherapy notes are "notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record."29 Further, psychotherapy notes do not include "medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date."30 In light of HIPAA's definition of psychotherapy notes, it is likely a request from a mental health facility will result in a response that no such notes exist. This is because the notes are kept separate from the medical record, and if they do exist, are likely part of the individual mental health professional's records, as opposed to the facility's records, and should be requested from that individual.

II. Use of Court Order to Obtain Mental Health and Substance Abuse Treatment Records
As with other medical records, the easiest way to obtain mental health or substance abuse treatment records is by obtaining the written consent of the patient. Under 42 C.F.R. Part 2, programs are prohibited from releasing records in response to a subpoena that is not accompanied by a signed consent or a valid court order.31 However, if a litigant refuses to sign a consent for release of mental health or substance abuse treatment records, an attorney can obtain the records by use of a court order accompanied by a subpoena.32 A court order obtained under the requirements of 42 C.F.R. Part 2 is a unique order and is not obtained in the same manner as one for the release of medical records.33

A valid court order is one issued in compliance with the procedures and standards set forth in Subpart E of the regulations, Sections 2.61-2.64. Before a court may issue an order authorizing the release of patient information, both the alleged patient (or representative) and the program or facility must be notified that a hearing will be held to decide whether an authorizing court order will be issued. Additionally, both the patient and the facility must be given an opportunity to appear in person or file a responsive statement.34 The court may then issue the order if the criteria set out in Sections 2.63 and 2.64 are met. (This is the criteria for use of substance treatment records in civil cases only. The criteria for obtaining a court order in criminal cases is found in 42 C.F.R. § 2.65.)

Again, because most mental health facilities also provide treatment for substance abuse or because persons with mental health issues often also have a diagnosis of substance abuse or are receiving treatment as part of their mental health treatment for alcohol or drug related issues, those records are protected by 42 C.F.R. Part 2. Thus, since an attorney will have no way of knowing until he gets the records whether drug or alcohol related information is contained in the records, he should follow the requirements of 42 C.F.R. Part 2. Without a consent or a valid court order, neither 42 C.F.R. Part 2 nor 43A O.S. §1-109 will even allow mental health or substance abuse treatment facility to acknowledge that a particular person has ever received treatment.35 For this reason, the facility cannot tell you in advance of the court order whether drug or alcohol related conditions are contained in the records.

Once an application for a valid court order has been filed and notices given to the holder of the records and the patient, 42 C.F.R. Part 2 requires the court to conduct a confidential hearing to determine if the records should be released.36 A court order under 42 C.F.R. Part 2 authorizing disclosure can only be entered if:

Additionally before entering an authorizing court order, the court must first determine that good cause exists to enter such an order.38 To make a determination good cause exists the court must find that:

If the court determines an order authorizing disclosure is appropriate, the order must meet the requirements of both 42 C.F.R. Part 2 and the HIPAA requirements for a qualified protective order. The HIPAA requirements for a qualified protective order are listed above in the medical records section. The 42 C.F.R. Part 2 requirements for a valid court order require the court to: limit disclosure to only those parts of the records that are essential to fulfill the objective of the order; limit disclosure to only those persons whose need for information is the basis for the order; and limit the disclosure in such a manner that the patient, the physician-patient relationship and treatment services are protected.40

III. Use of a Business Associate/Qualified Service Organization Agreement to Obtain Mental Health and Substance Abuse Treatment Records
Just as HIPAA requires attorneys representing health care providers maintaining medical records to enter into a Business Associate Agreement before viewing the records, so too must attorneys representing substance abuse treatment providers enter into such agreements. However, 42 C.F.R. Part 2 also requires the attorney representing the substance abuse treatment provider to enter into a Qualified Service Organization Agreement before accessing any of its client's records, including the records of the patient at issue.41 Fortunately these two documents can be combined into a Business Associate/Qualified Service Organization Agreement. Some of the provisions that HIPAA requires in its business associate agreement are in conflict with the more restrictive requirements of the 42 C.F.R. Part 2 qualified service organization agreement. Because the 42 C.F.R. Part 2 requirements provide greater protection to the patient's confidentiality, those requirements and not the HIPAA requirements should be followed. A sample Business Associate/Qualified Service Organization Agreement can be found on the Internet at 1) http://my.okbar.org/ or 2) www.oba-net.org, File Library, Litigation & Appeals.

CONCLUSION

There are stiff criminal penalties for the violation of HIPAA and 42 C.F.R. Part 2. So don't get upset with health care providers that are very strict in their interpretation of the requirements of those laws. If the health care provider disagrees with your interpretation of HIPAA or 42 C.F.R. Part 2 either ask them to explain what you need to do to satisfy his requirements, or follow the above outline for using the courts to obtain access to those records.

The provisions of state and federal law regarding the confidentiality of medical, mental health and substance abuse treatment records are in place to protect patient's records. It is important for us as attorneys to respect the confidentiality of these records for we too may some day be a patient whose records need protecting. At the same time, however, attorneys should not use these rules to prevent the legitimate discovery of relevant medical, mental health and substance abuse treatment records. By following the safeguards of HIPAA, 42 C.F.R. Part 2 and 43A O.S. § 1-109, we can insure that only those records reasonably needed in a civil case will be disclosed and that once disclosed the parties will treat those records with the same confidentiality as the health care provider did when the records were in its possession.

1. 45 C.F.R. Parts 160 and 164
2. 42 U.S.C. § 290dd-2
3. 12 O.S. § 2503 and 43A §1-109
4. 76 O.S. § 19
5. 42 C.F.R. § 2.13 (a) & (b)
6. 45 C.F.R. § 164.506
7. 45 C.F.R. § 164.508
8. 42 C.F.R. § 2.31
9. 43A O.S. § 1-109
10. 45 C.F.R. § 164.508 (c) and 63 O.S. § 1-502.2(B)
11. 45 C.F.R. §164.512 (e)
12. 45 C.F.R. §164.512 (e) (i)
13. 45 C.F.R. § 164.512 (e)(ii)
14. 45 C.F.R. § 164.512 (e)(iv)
15. 45 C.F.R. § 164.512 (e)(v)
16. 65 Fed.Reg. 82530
17. 45 C.F.R. § 160.103, § 164.502 (e )(1) & § 164.504 (e) (1)
18. 45 C.F.R. § 164.504 (e) (1)
19. Id.
20. 45 C.F.R. § 164.508
21. 45 C.F.R. § 160.202 and 160.203
22. 42 C.F.R. § 2.12
23. A program is "federally assisted" and covered by 42 C.F.R. Part 2 if it receives federal funds in any form even if not used to pay for alcohol or drug abuse treatment services, is tax exempt, is authorized to conduct business by the federal government of is conducted directly by the federal government or by a state or local government that receives federal funds which could be used for alcohol or drug abuse programs. 42 C.F.R. § 2.12(b)
24. 42 C.F.R. §§ 2.11 and 2.12
25. 45 C.F.R. § 164.508 (c); 42 C.F.R. 2.31 (a); 43A O.S. § 1-109 and 450 O.A.C. §§ 16-17-3.1, 17-9-1.1, 18-7-3.1 and 23-7-1.1
26. 42 C.F.R. § 2.3 (b) (1) and § 2.61
27. 42 C.F.R. § 2.3 (b) (1)
28. 45 C.F.R. § 164.508 (b) (3) (ii)
29. 45 C.F.R. § 164.501
30. Id.
31. 42 C.F.R. § 2.13 (a) & (b)
32. 42 C.F.R. § 2.61
33. Id.
34. 42 C.F.R. § 2.64
35. 42 C.R.F. § 2.13 (c)
36. 42 C.F.R. § 2.64 (c)
37. 42 C.F.R. § 2.63
38. 42 C.F.R. § 2.64 (d)
39. Id.
40. 42 C.F.R. § 2.64 (e)
41. 42 C.F.R. § 2.12 (c) (4)

Examples of the four forms mentioned in this article can be found on the Internet by logging on to 1) http://my.okbar.org/ or 2) www.oba-net.org,  File Library, Litigation & Appeals. If you need assistance to access either of these resources, contact the OBA Management Assistance Program Dept. at (405) 416-7008 or (800) 522-8065.

ABOUT THE AUTHORS

D. Renée Hildebrant is Assistant General Counsel for the Department of Mental Health and Substance Abuse Services. She graduated from Oklahoma City University School of Law in 1994. She has worked in civil litigation throughout her legal career and has represented both Plaintiffs and Defendants. Ms. Hildebrant is the Department of Mental Health and Substance Abuse Services' designated HIPAA attorney.

Jami J. Fenner is General Counsel for the Department of Mental Health and Substance Abuse Services. She graduated from Tulane Law School in 1989. She has been practicing law in Oklahoma since 1990 and started working for the State in 1994 as an Assistant Attorney General. She has represented various governmental entities practicing primarily in the areas of employment, civil rights and tort litigation and administrative and health care law.